build(deps): Bump handlebars from 4.7.9 to 4.7.10 in /packages/cli #3

Open

ggrace wants to merge 3 commits from dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10 into develop

pull from: dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10

merge into: ggrace:develop

ggrace:master

ggrace:ci/forgejo-workflows

ggrace:dependabot/npm_and_yarn/langchain/mongodb-1.3.1

ggrace:develop

ggrace:dependabot/npm_and_yarn/vm2-3.12.2

ggrace:dependabot/npm_and_yarn/simple-git-4.0.1

ggrace:fix/editor-vars-workflow-project

Conversation 0 Commits 3 Files changed 3 +15 -23

ggrace commented 2026-10-10 07:21:39 -04:00

Owner

Copy link

Bumps handlebars from 4.7.9 to 4.7.10.

Release notes

Sourced from handlebars's releases.

v4.7.10

• security: Sanitize the source map URL when minifying - f37c599
• security: Iterate lazily in #each and strip whitespace in linear time - 812c226
• security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
• security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
• security: Only compile partials that are template strings - c28ee7a
• security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
• security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
• Clarify that --root does not restrict filesystem access - 0fcf25c
• Bump minimist to ^1.2.8 - ea8ed82
• Fix Ruby component publishing documentation - d069c1c
• Fix Composer component definition - 6714e07

Compatibility notes:

• {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.10 - October 5th, 2026

• security: Sanitize the source map URL when minifying - f37c599
• security: Iterate lazily in #each and strip whitespace in linear time - 812c226
• security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
• security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
• security: Only compile partials that are template strings - c28ee7a
• security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
• security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
• Clarify that --root does not restrict filesystem access - 0fcf25c
• Bump minimist to ^1.2.8 - ea8ed82
• Fix Ruby component publishing documentation - d069c1c
• Fix Composer component definition - 6714e07

Compatibility notes:

• {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Commits

• 45ce152 v4.7.10
• e47b236 Update release notes
• f37c599 Sanitize the source map URL when minifying
• 812c226 Iterate lazily in #each and strip whitespace in linear time
• 609d1b1 Escape <!-- and <script in precompiled output
• ceec388 Don't trust special properties on context data
• c28ee7a Only compile partials that are template strings
• 7d501a5 Only dispatch known node types in the Compiler and Visitor
• 703fdcc Validate AST values in the compiler instead of the parser
• 0fcf25c Clarify that --root does not restrict filesystem access
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Migrated from GitHub PR #76.

Bumps [handlebars](https://github.com/handlebars-lang/handlebars.js) from 4.7.9 to 4.7.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/handlebars-lang/handlebars.js/releases">handlebars's releases</a>.</em></p> <blockquote> <h2>v4.7.10</h2> <ul> <li>security: Sanitize the source map URL when minifying - f37c599</li> <li>security: Iterate lazily in #each and strip whitespace in linear time - 812c226</li> <li>security: Escape <code>&lt;!--</code> and <code>&lt;script</code> in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7</li> <li>security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f</li> <li>security: Only compile partials that are template strings - c28ee7a</li> <li>security: Only dispatch known node types in the Compiler and Visitor - 7d501a5</li> <li>security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj</li> <li>Clarify that --root does not restrict filesystem access - 0fcf25c</li> <li>Bump minimist to ^1.2.8 - ea8ed82</li> <li>Fix Ruby component publishing documentation - d069c1c</li> <li>Fix Composer component definition - 6714e07</li> </ul> <p>Compatibility notes:</p> <ul> <li><code>{{#each}}</code> iterates iterables such as <code>Map</code>, <code>Set</code> and generators lazily, like <code>for...of</code>, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.</li> </ul> <p><a href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10">Commits</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md">handlebars's changelog</a>.</em></p> <blockquote> <h2>v4.7.10 - October 5th, 2026</h2> <ul> <li>security: Sanitize the source map URL when minifying - f37c599</li> <li>security: Iterate lazily in #each and strip whitespace in linear time - 812c226</li> <li>security: Escape <code>&lt;!--</code> and <code>&lt;script</code> in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7</li> <li>security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f</li> <li>security: Only compile partials that are template strings - c28ee7a</li> <li>security: Only dispatch known node types in the Compiler and Visitor - 7d501a5</li> <li>security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj</li> <li>Clarify that --root does not restrict filesystem access - 0fcf25c</li> <li>Bump minimist to ^1.2.8 - ea8ed82</li> <li>Fix Ruby component publishing documentation - d069c1c</li> <li>Fix Composer component definition - 6714e07</li> </ul> <p>Compatibility notes:</p> <ul> <li><code>{{#each}}</code> iterates iterables such as <code>Map</code>, <code>Set</code> and generators lazily, like <code>for...of</code>, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.</li> </ul> <p><a href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10">Commits</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/45ce15255e0f430ac6d19742b18e316b7539264e"><code>45ce152</code></a> v4.7.10</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/e47b2365d5656ab5689ae226aef90a485a90c5d8"><code>e47b236</code></a> Update release notes</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/f37c599de9187715eb1e9afedcb2d80c175487a0"><code>f37c599</code></a> Sanitize the source map URL when minifying</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/812c2260cb8794ef4ab63a7f1d946431112560ca"><code>812c226</code></a> Iterate lazily in #each and strip whitespace in linear time</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725"><code>609d1b1</code></a> Escape <code>&lt;!--</code> and <code>&lt;script</code> in precompiled output</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa"><code>ceec388</code></a> Don't trust special properties on context data</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/c28ee7adb312308e0fe26f4d435a481be5e1ff98"><code>c28ee7a</code></a> Only compile partials that are template strings</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/7d501a5af2ac3aa9ac788a8889dbe419849e46f1"><code>7d501a5</code></a> Only dispatch known node types in the Compiler and Visitor</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2"><code>703fdcc</code></a> Validate AST values in the compiler instead of the parser</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/0fcf25c63038b43e78e17adbf029cf073e80554d"><code>0fcf25c</code></a> Clarify that --root does not restrict filesystem access</li> <li>Additional commits viewable in <a href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ggrace519/n8n/network/alerts). </details> --- _Migrated from GitHub PR #76._

ggrace added 3 commits 2026-10-10 07:21:39 -04:00

build(deps): Bump handlebars from 4.7.9 to 4.7.10 in /packages/cli ... 4b6771f14f

Bumps [handlebars](https://github.com/handlebars-lang/handlebars.js) from 4.7.9 to 4.7.10.
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md)
- [Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10)

---
updated-dependencies:
- dependency-name: handlebars
  dependency-version: 4.7.10
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'origin/develop' into dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10 ca29374ad3

build(deps): Move the handlebars override to 4.7.10 so the bump takes effect ... 58c62be5c1

The root pnpm override pinned handlebars to 4.7.9, which made the package.json
bump in packages/cli a no-op. Raise the override to match and regenerate the
lockfile entry (pnpm install --lockfile-only).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018F9GRMoJ5bpYz885WDquXV

Some checks failed

Hide all checks

build-windows.yml / build(deps): Move the handlebars override to 4.7.10 so the bump takes effect (push) Failing after 0s

Details

release-build-daytona-snapshot.yml / build(deps): Move the handlebars override to 4.7.10 so the bump takes effect (push) Failing after 0s

Details

release-promote-backport-labels.yml / build(deps): Move the handlebars override to 4.7.10 so the bump takes effect (push) Failing after 0s

Details

sbom-generation-callable.yml / build(deps): Move the handlebars override to 4.7.10 so the bump takes effect (push) Failing after 0s

Details

test-evals-mcp.yml / build(deps): Move the handlebars override to 4.7.10 so the bump takes effect (push) Failing after 0s

Details

test-workflows-callable.yml / build(deps): Move the handlebars override to 4.7.10 so the bump takes effect (push) Failing after 0s

Details

build-windows.yml / build(deps): Move the handlebars override to 4.7.10 so the bump takes effect (pull_request) Failing after 0s

Details

release-build-daytona-snapshot.yml / build(deps): Move the handlebars override to 4.7.10 so the bump takes effect (pull_request) Failing after 0s

Details

release-promote-backport-labels.yml / build(deps): Move the handlebars override to 4.7.10 so the bump takes effect (pull_request) Failing after 0s

Details

sbom-generation-callable.yml / build(deps): Move the handlebars override to 4.7.10 so the bump takes effect (pull_request) Failing after 0s

Details

test-evals-mcp.yml / build(deps): Move the handlebars override to 4.7.10 so the bump takes effect (pull_request) Failing after 0s

Details

test-workflows-callable.yml / build(deps): Move the handlebars override to 4.7.10 so the bump takes effect (pull_request) Failing after 0s

Details

CI: Validate CODEOWNERS / validate (pull_request) Failing after 2s

Details

CI: PR Quality Checks / Handle /size-limit-override (pull_request) Has been skipped

Details

CI: PR Quality Checks / PR Size Limit (pull_request) Failing after 51s

Details

CI: PR Quality Checks / Detect Changes (pull_request) Successful in 8s

Details

CI: PR Quality Checks / Do Not Merge (pull_request) Successful in 1s

Details

CI: Master (Build, Test, Lint) / Build for Github Cache (pull_request) Failing after 1m54s

Details

CI: PR Quality Checks / Static Analysis (pull_request) Failing after 2m36s

Details

CI: PR Quality Checks / Required PR Quality Checks (pull_request) Failing after 2s

Details

CI: Master (Build, Test, Lint) / Backend Unit Tests (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Backend Integration Tests (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Nodes Unit Tests (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Frontend (1/2) (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Frontend (2/2) (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Backend Unit Tests-1 (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Backend Integration Tests-1 (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Nodes Unit Tests-1 (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Frontend (1/2)-1 (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Frontend (2/2)-1 (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Lint-1 (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Benchmarks (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Install & Build (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Unit tests (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Unit tests-1 (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Lint (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Performance (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Notify Slack on failure (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Unit tests-2 (pull_request) Has been cancelled

Details

CI: Master (Build, Test, Lint) / Unit tests-3 (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Unit tests (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Typecheck (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Lint (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Check packaging (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Prepare Docker (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / SQLite: Sanity Check (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / E2E (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Dev-server boot smoke (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / DB Tests (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Performance (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / E2E Performance (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Security Checks (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Workflow scripts (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Instance AI Discovery Evals (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Required Checks (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / QA Metrics (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / prepare-docker (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / build-and-test-performance (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Canvas Perf Sentinels (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Build & publish image (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Shard 1 (pull_request) Has been cancelled

Details

CI: Pull Requests (Build, Test, Lint) / Post Metrics Comment (pull_request) Has been cancelled

Details

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10:dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10

git switch dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch develop

git merge --no-ff dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10

git switch dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10

git rebase develop

git switch develop

git merge --ff-only dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10

git switch dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10

git rebase develop

git switch develop

git merge --no-ff dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10

git switch develop

git merge --squash dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10

git switch develop

git merge --ff-only dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10

git switch develop

git merge dependabot/npm_and_yarn/packages/cli/handlebars-4.7.10

git push origin develop

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ggrace/n8n!3

No description provided.